The most typical flight control system used in current aircraft relies upon direct mechanical linkages between the pilot's control devices and aircraft flight control surfaces. Thus, when a pilot manipulates controls such as the rudder pedals, various levers, and the control column, mechanical linkages transmit movement of the controls to aircraft flight control surfaces, such as rudders, ailerons, flaperons, and elevators, to move these surfaces appropriately in response. This system provides several advantages. Not only is the system relatively simple with predictable failure modes and effects, but it provides direct control of the aircraft control surfaces. The system is also reliable, since aircraft manufacturers and operators have had long experience with mechanical flight control systems.
There has now been developed an aircraft flight control system that is not reliant on direct mechanical linkages but uses electronic controllers that receive and transmit electrical signals to control devices, such as hydraulic actuators, that in turn control the movement of aircraft flight control surfaces. This type of system, known as a "fly-by-wire" system, provides significant advantages over the direct mechanically linked flight systems. The use of highly reliable electronic signals generated in response to pilot manipulation of flight deck controls or autopilot commands, instead of mechanical linkages, provides the possibility of improved overall system reliability and performance. Also, the system is easier to maintain.
The fly-by-wire aircraft control system, however, imposes new system monitoring requirements. In general, when a mode of failure of a subsystem is predictable, then a monitor can be developed to sense and signal the failure of the subsystem, when it fails according to the predicted mode. There are, however, certain subsystems for which the failure modes are neither readily predictable nor are symptoms of failure easily detectable. Also, in certain circumstances, monitoring the effects of a failure on a flight control surface may require a very sensitive sensing device, which may lead to false warnings (i.e., an indication of failure when there is none) sometimes necessitating an unnecessary shutdown of the subsystem. For example, if an elevator were monitored by sensing motion of the elevator surface, then setting the sensor to detect only wide variations in movement may not permit detection of smaller movements that may nevertheless result from an actuator malfunction. On the other hand, if the sensor is set for high sensitivity to detect small movements, then the sensor may falsely report failure, when the small movements detected are not symptomatic of a failure, leading to unnecessary system shutdown. Such shutdowns are not only expensive, in terms of unnecessary aircraft downtime for repairs, but may also somewhat decrease flight safety margin by decreasing the redundancy of control systems of the aircraft.
There exists a need for a system for detecting failures in subsystems of fly-by-wire primary flight control systems, especially those subsystems that are not readily monitored because all their failure modes are not readily predictable and may not be easily detected by conventional monitors. Further, the monitoring system should desirably be readily integrated with existing equipment of the primary flight control system and the aircraft's primary flight control computer and should not be susceptible to a high frequency of false positive failure reports.